CVE-2026-32692: Unauthorized update of out-of-scope Vault secrets
An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authenticated unit agent to perform unauthorized updates to secret revisions. With sufficient information, an attacker can poison any existing secret revision within the scope of that Vault secret back-end.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32692?
CVE-2026-32692 has a medium severity rating due to its potential for unauthorized updates to Vault secrets.
How do I fix CVE-2026-32692?
To fix CVE-2026-32692, upgrade Juju to a version higher than 3.6.18.
What versions of Juju are affected by CVE-2026-32692?
Juju versions 3.1.6 through 3.6.18 are affected by CVE-2026-32692.
What impact does CVE-2026-32692 have on security?
CVE-2026-32692 allows an authenticated unit agent to perform unauthorized updates, potentially compromising the security of stored secrets.
Who can exploit CVE-2026-32692?
An authenticated user with access to the affected Juju versions can exploit CVE-2026-32692 if they possess sufficient information.